Cybertection Net Guard Ai (for windows & linux)

 

How to Use CyberTection NetGuard

1. Launching the Application

Simply double-click the CyberTectionNetGuard.exe (or similarly named) file to start the application. You should see the main window with three tabs: "Email Analysis," "Model Training (Custom)," and "Settings & Models."

2. Analyzing Emails (Email Analysis Tab)

This is the primary tab for checking individual emails.

• Enter Email Details:
  • Sender's Email Address (Optional): Type or paste the sender's email address into this field. This helps with heuristic checks related to the sender's domain.
  • Enter Email Text: Paste the full content (body) of the email you want to analyze into this large text box.
• Load Email File:
  • Alternatively, click the "Load Email File" button to open a file dialog.
  • You can load .txt or .eml files. The application will attempt to populate the "Sender's Email Address" and "Email Text" fields from the file.
• Analyze:
  • Once the email text is entered (and optionally the sender), click the "Analyze Email (Combined)" button.
  • The application will perform several checks:

    Heuristic Analysis: Checks for common phishing indicators in the sender's address and email content (e.g., suspicious keywords, urgency phrases, link patterns). These clues are displayed in the "Detected Heuristic Clues" section on the right.

    Sklearn Model Analysis: If a custom Scikit-learn model is loaded or has been trained, it will analyze the email content.

    Hugging Face Model Analysis: The pre-trained H1tak3/rag-phishing-detector model will also analyze the email content. (Requires an internet connection the first time it runs to download the model files).

• Understanding Results:
  • Detected Heuristic Clues: Provides a list of potential red flags based on common patterns.
  • Analysis Results (Main Box):
    • Sklearn Model: Shows the prediction ("POTENTIAL PHISHING" or "Likely Legitimate") and the model's confidence in detecting phishing.
    • Hugging Face Model: Shows the prediction (e.g., "PHISHING" or "SAFE") from the H1tak3/rag-phishing-detector model and its confidence in detecting phishing.
    • Combined Assessment: Provides an overall summary based on the outputs of both AI models. This can range from "STRONG CONSENSUS: PHISHING" if both models agree strongly, to "MIXED SIGNALS" if they disagree, or "LIKELY SAFE" if both indicate the email is legitimate.
• Clear:
  • Click the "Clear" button to remove all text from the input fields and results areas.

3. Training a Custom Model (Model Training (Custom) Tab)

This tab allows you to train your own Scikit-learn based phishing detection model using your datasets.

• Load Datasets:
  • Load Legitimate Data (.csv): Click this button to select a CSV file containing examples of legitimate (non-phishing) emails.
  • Load Phishing Data (.csv): Click this button to select a CSV file containing examples of phishing emails.
  • Email Text Column Name: Ensure the name of the column in your CSV files that contains the actual email text is entered in this field (default is "text"). The application will try to guess this column if it's a common name like "body" or "email".
  • The status of loaded datasets (filename, number of rows, column used) will be displayed next to the buttons.
• Train Model:
  • Once both legitimate and phishing datasets are loaded, click the "Train Custom Model" button.
  • The training process will begin in the background. You can monitor its progress via the progress bar and messages in the "Training Log & Results" area.
• Training Log & Results:
  • This area shows detailed steps of the training process, including preprocessing, TF-IDF vectorization, model fitting, and evaluation.
  • After training, a summary including accuracy and a confusion matrix will be displayed.
• Performance Visual:
  • A bar chart showing the model's accuracy and a visual representation of the confusion matrix will appear on the right, helping you assess the custom model's performance.

4. Settings & Models (Settings & Models Tab)

This tab allows you to manage your trained Scikit-learn models and the Hugging Face model.

• Custom Sklearn Model Management:
  • Save Trained Sklearn Model: If you have trained a custom model in the "Model Training (Custom)" tab, you can click this button to save the TF-IDF vectorizer and the Random Forest classifier to .pkl files.
  • Load Sklearn Model from File: Click this to load previously saved TF-IDF and classifier .pkl files. This allows you to use a trained custom model without retraining.
  • Status Indicators: Shows whether a TF-IDF vectorizer and a Sklearn Classifier are currently loaded.
• Pre-trained Hugging Face Model:
  • Model: Displays the name of the Hugging Face model being used (e.g., H1tak3/rag-phishing-detector).
  • Status: Shows the current status of the Hugging Face model (e.g., "Not Loaded," "Loading...," "Loaded," "Load Failed").
  • Load / Reload Model: Click this button to attempt to load (or reload) the Hugging Face model. This is useful if the initial load failed or if you want to try loading it again.
    • Note: Loading the Hugging Face model for the first time requires an active internet connection as it needs to download the model files from the Hugging Face Hub. Subsequent launches should load the model from a local cache, but an internet connection check might still occur.

5. Status Bar

The bar at the very bottom of the window provides general status updates about the application's operations (e.g., "Ready," "Analyzing...," "Model loaded," error messages).

Important Notes:

• Internet for Hugging Face Model: The first time the application tries to use the Hugging Face model, it will download the model files. Ensure you have an active internet connection.
• CSV Format for Training: When preparing your custom training datasets, ensure they are in CSV format and that one column clearly contains the full email text.
• Model Performance: The accuracy of any AI model, including those in CyberTection NetGuard, depends heavily on the quality and representativeness of the data it was trained on. The heuristic clues provide additional context. Always use your judgment when assessing potentially malicious emails.